Authenticated users in Winter CMS versions prior to 1.2.13 can bypass sandbox protections to achieve remote code execution and full system compromise.

The system fails to properly enforce security policies within the Twig sandbox, allowing an authenticated backend user with template-editing permissions to escape restrictions. Attackers can leverage model-based methods to manipulate database records, execute arbitrary SQL, and ultimately achieve remote code execution on the underlying server.

This vulnerability allows an authenticated attacker to move from restricted template editing to full system control. The potential for arbitrary code execution and database modification poses a critical risk to data confidentiality, integrity, and availability. With a CVSS score of 8.4, this issue is a significant threat to any enterprise relying on Winter CMS.

Immediate Action: Upgrade Winter CMS to version 1.2.13 or later to apply the patched security policy and sandbox protections.

Proactive Monitoring: Audit administrative accounts and review logs for unauthorized modifications to templates or unusual database queries.

Compensating Controls: Strictly limit the number of users with template-editing privileges and monitor backend activity for suspicious usage of model-related methods.

Public Exploit Available: No (exploit_available: unknown)

While the vulnerability requires authenticated access, the impact of remote code execution is severe. Administrators must prioritize updating to the latest version and review the permissions of all users with backend access to minimize the window of opportunity for malicious insiders or compromised accounts.